Agent Integration Patterns

TameFlare is a transparent HTTP proxy. It governs agent traffic at the network level, not the application level. This means compatibility depends on how the agent makes HTTP requests, not which framework it uses.

This page lists every known integration pattern, whether TameFlare supports it, and what you get.


Compatibility matrix

#PatternHow the agent calls APIsTameFlare supportPolicy enforcementCredential isolationAudit trailNotes
1Agent with env var credentialsAgent reads STRIPE_SECRET_KEY from env, attaches to HTTP requestFullYesYes - agent gets dummy key, vault injects real keyYesMost common pattern. LangChain, CrewAI, n8n, custom agents.
2Agent with extension/plugin credentialsExtension (e.g., OpenClaw skill, n8n node) has its own credential store and attaches real key to HTTP requestFull (policy + audit)YesNo - extension already has real key. TameFlare passes it through.YesYou still get action-level allow/deny/approval and full audit trail. Credential isolation requires migrating keys to TameFlare vault.
3MCP server (Streamable HTTP transport)Agent calls MCP server via POST /mcp over HTTP. MCP server calls upstream APIs over HTTP.Full (both hops)Yes - both the agent→MCP and MCP→upstream hops are HTTPYes - if MCP server process runs through tf runYesWrap the MCP server process with tf run to intercept its outbound traffic. The agent→MCP hop is also intercepted if the agent runs through tf run.
4MCP server (stdio transport)Agent launches MCP server as local subprocess, communicates via stdin/stdout. MCP server calls upstream APIs over HTTP.PartialOnly the MCP server's outbound HTTP calls (if the MCP server process inherits proxy env vars)Only for outbound HTTPOnly for outbound HTTPThe agent↔MCP communication is local IPC (stdin/stdout), not HTTP - TameFlare cannot intercept it. But the MCP server's outbound API calls are HTTP and can be proxied if env vars are inherited.
5Agent using HTTP library that respects proxy env varsPython requests, httpx, urllib3; Node http/https, axios, node-fetch; Go net/http; Java HttpClient; Rust reqwestFullYesYesYesThis covers the vast majority of HTTP libraries. The OS-level HTTP_PROXY/HTTPS_PROXY convention is widely supported.
6Agent using HTTP library that ignores proxy env varsSome low-level or custom HTTP clients (raw sockets, custom TLS, curl without --proxy)NoneNoNoNoRare. Most production HTTP libraries respect proxy env vars. If you encounter this, configure the library to use a proxy explicitly.
7Agent making local function callsAgent calls a Python/JS function that internally calls an API (e.g., Stripe SDK stripe.charges.create())Full (if SDK uses HTTP internally)Yes - the Stripe SDK makes HTTP requests under the hood, which go through the proxyYesYesSDKs like stripe-python, openai-python, slack-sdk all use requests or httpx internally, which respect proxy env vars.
8Agent calling local services (localhost)Agent calls http://localhost:8080/api/... or similar local endpointsFullYes - local HTTP traffic goes through the proxyDepends on connector configYesMatched by the generic HTTP connector. Useful for governing internal service calls.
9Agent using WebSocket connectionsAgent opens a persistent WebSocket to an API (e.g., real-time streaming)NoneNoNoNoTameFlare's proxy handles HTTP/HTTPS request-response cycles. WebSocket upgrade requests are not currently intercepted. Future consideration.
10Agent using gRPCAgent calls APIs via gRPC (HTTP/2 + protobuf)NoneNoNoNogRPC uses HTTP/2 but with binary framing that TameFlare's connectors cannot parse into structured action types. Future consideration.
11Agent using GraphQLAgent sends GraphQL queries/mutations over HTTP POSTPartialYes - HTTP request is intercepted. Action type is generic (generic.post) unless a custom connector parses the GraphQL body.YesYesThe generic HTTP connector matches by domain + HTTP method. A custom connector could parse the GraphQL operation name for richer action types (e.g., github.graphql.mutation.mergePullRequest).
12Agent running in a container (Docker)Agent process runs inside a Docker containerFullYesYesYesSet HTTP_PROXY and HTTPS_PROXY env vars in the container, pointing to the gateway running on the host (or as a sidecar). Use tf run inside the container or configure proxy env vars in docker-compose.yml.
13Agent running in CI/CD (GitHub Actions, etc.)Agent runs as part of a CI pipelineFullYesYesYesInstall CLI, run tf init --gateway-id gw_xxx --gateway-token gwtk_xxx, then tf run -- your-agent-command. See CI/CD Integration.
14Multi-agent orchestration (CrewAI, AutoGen)Multiple agents share one process, each making HTTP callsFull (shared gateway)Yes - all agents in the process share the same proxyYes - all agents share the same credential vaultYes - audit trail shows gateway name, not individual agentFor per-agent isolation, run each agent as a separate process with its own gateway.
15Agent-to-agent HTTP callsAgent A calls Agent B via HTTP (e.g., A2A protocol)FullYes - the HTTP call goes through the proxyDepends on configYesBoth the inter-agent call and Agent B's outbound calls are governed if both run through tf run.
16Browser-based agent (client-side JS)Agent runs in a web browser and makes fetch() callsNoneNoNoNoBrowsers do not respect HTTP_PROXY env vars. Browser-based agents would need a server-side proxy relay. Not a current use case for TameFlare.
17Serverless function (AWS Lambda, Cloudflare Workers)Agent runs as a serverless functionPartialYes - if HTTP_PROXY env vars are set in the function configYesYesThe gateway must be network-reachable from the serverless environment. Latency may increase due to proxy hop.
18SSH / non-HTTP protocolsAgent executes commands via SSH, FTP, SMTP, or other non-HTTP protocolsNoneNoNoNoTameFlare is an HTTP/HTTPS proxy. Non-HTTP protocols are not intercepted.

Decision flowchart

Use this to determine if TameFlare can govern a specific agent action:

1. Does the action result in an outbound HTTP/HTTPS request?
   ├─ NO  → TameFlare cannot intercept it (WebSocket, gRPC, SSH, stdio, etc.)
   └─ YES ↓

2. Does the HTTP library respect HTTP_PROXY / HTTPS_PROXY env vars?
   ├─ NO  → Configure the library to use a proxy explicitly, or switch libraries
   └─ YES ↓

3. Is the agent process started with `tf run` (or proxy env vars set manually)?
   ├─ NO  → Traffic bypasses TameFlare entirely
   └─ YES ↓

4. Does a connector match the target domain?
   ├─ NO  → Generic HTTP connector handles it (domain + HTTP method only)
   └─ YES → Full structured action types, rich parameters, risk classification

Result: TameFlare enforces policies, logs audit trail, and optionally isolates credentials.

Credential isolation: when it works and when it doesn't

ScenarioCredential isolation?How
Agent reads API key from env varYesGive agent a dummy key. TameFlare strips it and injects the real key from the vault.
Agent uses SDK that reads env var internallyYesSame as above - the SDK's HTTP requests go through the proxy.
Extension/plugin has its own credential storeNo (by default)The extension attaches the real key before the request reaches TameFlare. Migrate keys to TameFlare vault for full isolation.
MCP server holds its own credentialsNo (by default)Same as extensions. The MCP server attaches credentials to its outbound requests.
Agent hardcodes credentials in source codeNoThe agent attaches the key directly. TameFlare can still enforce policies and audit, but cannot strip/replace the key.

Future considerations

These patterns are not currently supported but could be engineered:

PatternChallengePotential approach
WebSocket interceptionPersistent bidirectional connection, not request-responseIntercept the HTTP upgrade request, then proxy the WebSocket frames. Would require frame-level parsing for action types.
gRPC interceptionBinary protobuf encoding, HTTP/2 multiplexingDecode protobuf messages using service descriptors. Requires the .proto file or reflection API.
GraphQL-aware connectorSingle endpoint, action type embedded in query bodyParse GraphQL operation name and type (query/mutation/subscription) from the POST body. Map to structured action types.
Browser agent supportNo HTTP_PROXY in browsersProvide a JavaScript SDK or service worker that routes fetch() through a TameFlare relay endpoint.
stdio MCP interceptionLocal IPC, not network trafficWrap the stdin/stdout pipe with a TameFlare shim that parses JSON-RPC messages and applies policies before forwarding.
Outbound DNS filteringAgent resolves domains before connectingIntegrate with DNS to block resolution of unauthorized domains, complementing HTTP-level enforcement.

Quick reference by framework

FrameworkTypical patternTameFlare supportSetup
LangChainEnv var credentials + requests libraryFulltf run -- python agent.py
CrewAIEnv var credentials + requests libraryFulltf run -- python crew.py
n8nBuilt-in credential store + axiosFull (policy + audit)tf run -- n8n start
OpenClawSkills with own credentials + requestsFull (policy + audit)tf run -- openclaw start
Claude CodeAnthropic API key from env + fetchFulltf run -- claude
Cursor / WindsurfIDE extension, own credential managementPartial - only if IDE's HTTP calls respect proxy env varsSet HTTP_PROXY in IDE config or terminal env
AutoGenEnv var credentials + httpxFulltf run -- python autogen_script.py
MCP servers (HTTP)Server holds credentials, Streamable HTTP transportFulltf run -- node mcp-server.js
MCP servers (stdio)Server holds credentials, stdin/stdout transportPartial - outbound HTTP onlyEnsure MCP server process inherits proxy env vars from parent
Custom agentsVariesFull if HTTP + proxy-aware librarytf run -- your-command

Next steps